CVE-2012-1410: XSS
A stored cross-site scripting (XSS) flaw was found in the way Kadu, the instant messenger compatible with the Gadu-Gadu protocol, performed sanitization of status and sms messages for particular contact in user's history. A remote attacker could provide a specially-crafted status or sms message, which would be stored in victim's Kadu history file, if the attacker was present on the contact list of the victim and the victim has had storage of statuses enabled for their history file. When the victim later examined the content of the status history, this flaw could lead to arbitrary HTML or webscript execution.
References: [1] https://bugzilla.novell.com/showbug.cgi?id=749036
Upstream patches: [2] https://gitorious.org/kadu/kadu/commit/ebe3674cf0f3aa9b36308c06e19cb293cc790b52 (patch for the XSS issue)
[3] https://gitorious.org/kadu/kadu/commit/e9506be6d3dcdd408fdf83d8eb82416c9b798c84 (additional hardening)
[4] https://gitorious.org/kadu/kadu/commit/91772e46541e22cbc2c7bf41a1a9798c2a58f6d6 (disable xhtmlrequests)
[5] https://gitorious.org/kadu/kadu/commit/94e7479617d78a1649a0763960edade7ad09a0d0 (allow only GET and HEADER requests, additional hardening)
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message, (2) presence message, or (3) status description.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1410?
CVE-2012-1410 is categorized as a moderate severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2012-1410?
To address CVE-2012-1410, users should upgrade Kadu to the latest version that contains the necessary sanitization fixes for status and SMS messages.
What versions of Kadu are affected by CVE-2012-1410?
CVE-2012-1410 affects Kadu versions 0.9.0, 0.10.0, and 0.11.0.
Can CVE-2012-1410 be exploited remotely?
Yes, CVE-2012-1410 can be exploited by remote attackers who provide specially-crafted messages to the affected Kadu client.
What type of vulnerability is CVE-2012-1410 classified as?
CVE-2012-1410 is classified as a stored cross-site scripting (XSS) vulnerability.